What is Formjacking?

As consumers are aware of, hackers are always working to separate them from their hard-earned cash. This time, it’s popular e-commerce websites that have been compromised. Known as formjacking, it’s not a new hacking technique. As recently reported by Symantec, like many hacks that are reboots of earlier versions, formjacking has returned with a vengeance–more sophisticated and powerful than ever before. Although formjacking is ultimately a problem for e-commerce to guard consumers against, the goal for hackers remains the same: Stealing financial data from online shoppers any way they can. As a result, consumers are always warned to closely monitor their credit card charges. E-commerce merchants have their hands full with the new and improved formjacking, and it’s no coincidence it coincides with one of the busiest online shopping times of the year.

At its most basic, formjacking steals shopper credit card and other financial information entered on a merchant website during a purchase. In this latest twist, Symantec discovered that shoppers in different countries worldwide are unknowingly redirected to a bogus website collecting data from them all. Everything appears normal with the online purchase, with retailers and consumers being none-the-wiser. Although the end game is still the same for consumers, it’s online merchants who need to step-up to find a way to prevent formjacking. According to Symantec, “This latest formjacking campaign highlights the fact that attackers are continuously altering and improving their malicious code and exploring new delivery mechanisms to infect more users.”

There are steps retail website owners can take to minimize the increasing formjacking attacks, starting with awareness of the hacks. Symantec offers these steps for online merchants and software producers to implement measures to counter the growing problem.

• E-commerce website owners should be aware of software supply chain attacks, as they are used by formjackers to infect websites and their consumer payment forms.

• New software updates should first be tested in small environments whenever possible to detect suspicious behaviors.

• Monitor all system activity to identify unwanted patterns, allowing any potential harm from a suspicious application to be blocked before any damage occurs.

• Merchants can use the content security feature called SRI (Subresource Integrity). SRI enables browsers to verify that resources aren’t unexpectedly manipulated.

• Software package producers must be able to do sufficient testing to detect trouble in their software updates and on their websites before they reach e-commerce sites.